Reference
Glossary
68 terms from hosting, networking, cryptography and jurisdiction, defined without marketing.
Short answer
This glossary defines 68 terms used across hosting, networking, storage, security, cryptocurrency and jurisdiction — from KVM and CPU steal time to MLAT, RingCT and the Fourteen Eyes. Each definition is written to stand alone, with the qualification that matters stated alongside the claim rather than after it.
Virtualisation
- KVM
- KVM is full hardware virtualisation built into the Linux kernel, giving each guest its own kernel and hardware-enforced isolation from other tenants.
- OpenVZ
- OpenVZ is container-based virtualisation in which every instance shares the host kernel, so guests cannot load kernel modules or run a different operating system.
- LXC
- LXC is Linux-native containerisation that isolates processes with namespaces and cgroups while sharing the host kernel.
- Hypervisor
- A hypervisor is the software layer that creates and runs virtual machines, allocating physical CPU, memory and IO between them.
- Nested virtualisation
- Nested virtualisation lets a virtual machine itself run virtual machines, by exposing the processor virtualisation extensions to the guest.
- vCPU
- A vCPU is a virtual processor presented to a guest, backed by scheduling time on a physical core or thread.
- cloud-init
- cloud-init is the standard mechanism for configuring a virtual machine on first boot, using metadata supplied by the platform.
Storage
- NVMe
- NVMe is a storage protocol that connects solid-state drives directly over PCIe, reaching roughly 500,000 random IOPS with sub-100-microsecond latency.
- IOPS
- IOPS measures how many individual read or write operations a storage device completes per second.
- RAID 10
- RAID 10 mirrors data across pairs of drives and stripes across the mirrors, giving both redundancy and high performance at the cost of half the raw capacity.
- Snapshot
- A snapshot is a point-in-time copy of a virtual machine disk, taken instantly and stored on the same infrastructure.
Networking
- ASN
- An ASN identifies a network that controls its own routing policy and announces its address space to the global routing table via BGP.
- BGP
- BGP is the protocol that autonomous systems use to exchange routing information and decide how traffic crosses the internet.
- IXP
- An IXP is a shared physical facility where networks interconnect directly rather than paying a transit provider to carry traffic between them.
- Peering
- Peering is a direct interconnection between two networks that exchange traffic with each other without paying a third party to carry it.
- IP transit
- Transit is a paid service in which one network carries another network's traffic to the rest of the internet.
- Anycast
- Anycast announces the same IP address from several locations at once, so each user is routed to the nearest instance by BGP.
- IPv6
- IPv6 is the current version of the Internet Protocol, using 128-bit addresses to replace the exhausted 32-bit IPv4 space.
- Reverse DNS
- Reverse DNS maps an IP address back to a hostname through a PTR record, the inverse of a normal DNS lookup.
- Port 25
- Port 25 is the TCP port used for server-to-server SMTP mail delivery.
- Unmetered bandwidth
- Unmetered means transfer volume is not counted, though the port speed still caps how much can move.
Performance
- CPU steal time
- Steal time is the proportion of time a virtual CPU was ready to run but the hypervisor gave the physical core to another guest.
- RTT
- RTT is the time for a packet to travel to a destination and for the response to return, measured in milliseconds.
- Jitter
- Jitter is variation in packet delay over time, as distinct from the average delay itself.
- TTFB
- TTFB measures the time from a request being sent to the first byte of the response arriving.
Security
- LUKS
- LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself.
- DDoS
- A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity.
- Traffic scrubbing
- Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones.
- Null route
- A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.
- fail2ban
- fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses.
Law & jurisdiction
- Warrant canary
- A warrant canary is a regularly republished statement that a provider has not received a secret legal demand; its disappearance implies that one has arrived.
- KYC
- KYC is the set of identity-verification duties imposed on regulated financial institutions before providing services.
- No-KYC hosting
- No-KYC hosting is server hosting that requires no identity verification — no government ID, billing address, phone number or payment card.
- Offshore hosting
- Offshore hosting means placing a server in a jurisdiction other than your own, typically one outside the Fourteen Eyes alliances and outside EU data-retention rules.
- Five Eyes
- The Five Eyes is a signals-intelligence sharing alliance between the United States, United Kingdom, Canada, Australia and New Zealand.
- Fourteen Eyes
- The Fourteen Eyes is the widest of the signals-intelligence sharing groupings, comprising the Five Eyes plus Denmark, France, the Netherlands, Norway, Belgium, Germany, Italy, Spain and Sweden.
- MLAT
- An MLAT is a treaty through which one country formally requests another to gather evidence on its behalf.
- DMCA
- The DMCA is United States copyright statute whose notice-and-takedown procedure and safe harbour apply to service providers situated in the United States.
- Data retention
- Data retention laws require communications providers to store connection metadata for a defined period so that authorities can obtain it later.
- GDPR
- The GDPR is the EU regulation governing processing of personal data of people in the EU, regardless of where the processing happens.
- IBC
- An IBC is a corporate form offered by jurisdictions such as Seychelles, Belize and the British Virgin Islands, characterised by confidentiality and minimal reporting.
- Bulletproof hosting
- Bulletproof hosting describes a provider that claims to ignore all abuse complaints and law enforcement, including for criminal activity.
Cryptocurrency
- Monero
- Monero is a cryptocurrency that hides sender, receiver and amount at the protocol level using ring signatures, stealth addresses and RingCT.
- Ring signature
- A ring signature proves that one member of a group signed a message without revealing which one.
- Stealth address
- A stealth address is a one-time destination address generated for each payment so that transactions to the same recipient cannot be linked.
- RingCT
- RingCT conceals transaction amounts on the Monero blockchain while still allowing the network to verify that inputs equal outputs.
- Stablecoin
- A stablecoin is a token pegged to a fiat currency, typically the US dollar, and backed by reserves held by an issuer.
- TRC-20
- TRC-20 is the token standard on the TRON blockchain, most commonly used for USDT.
- Confirmation
- A confirmation is a block added to the chain after the block containing a transaction, each making reversal exponentially harder.
- Atomic swap
- An atomic swap exchanges two cryptocurrencies directly between wallets, with cryptography guaranteeing that either both sides complete or neither does.
Privacy tooling
- WireGuard
- WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite.
- OpenVPN
- OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.
- Tor
- Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.
- Tor exit node
- A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic.
- Onion service
- An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.
- SOCKS5
- SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
- Shadowsocks
- Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
- No-logs policy
- A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.
- SPF
- SPF is a DNS record listing which servers are authorised to send mail for a domain.
- DKIM
- DKIM cryptographically signs outgoing messages so a receiver can verify the domain and that the content was not altered in transit.
- DMARC
- DMARC tells receivers what to do with messages that fail SPF and DKIM, and where to send aggregate reports.
Operations
- SLA
- An SLA is a contractual commitment to a service level, usually availability, with defined compensation when it is missed.
- Out-of-band console
- An out-of-band console attaches to a virtual machine's display and keyboard independently of its network connection.
- Custom ISO
- Custom ISO support lets you upload an installer image and boot the instance from it, rather than choosing from a fixed template list.
- Terraform
- Terraform declares infrastructure in configuration files and reconciles the real environment against them.
- Seedbox
- A seedbox is a server dedicated to downloading and seeding torrents at high speed, typically with large storage and a fast uplink.
- Control panel
- A control panel is a web interface for administering servers, websites, mail and databases — cPanel, DirectAdmin, CyberPanel and similar.
- Provisioning
- Provisioning is the process of creating, configuring and delivering a server so that it is ready to use.